Built for the organisations that can't afford to get identity wrong.

What Handled Cloud stands for.

Standards-first

Every protocol, cipher, and cookie convention the stack runs is a named standard your team already knows. Nothing proprietary sits between your identity provider and your origins.

OIDC: Login, logout, and identity claims against any OIDC-compliant identity provider.
OAuth 2.0: The authorization code flow that swaps the browser login for a token set at the edge.
PKCE: A per-login code verifier proves the browser that started the login is the one that finishes it.
__Host- cookies: Session cookies carry the __Host- prefix, so the browser enforces HttpOnly, Secure, and exact-host scoping.
AES-256-GCM: Identity provider credentials are encrypted with AES-256-GCM before they are stored.

Works with Okta, Ping, Entra ID, Cognito, or any other OIDC-compliant identity provider you already run. The Handled Cloud stack is the only piece that knows about your identity provider; your applications do not.

Secure by design

Security is a design constraint, not a feature. The safe configuration is the default, and the mechanism is documented on the security page.

Reduce IDP lock-in

Handled Cloud is IDP-agnostic by design. The engineering cost to migrate between identity providers is the cost of updating one Handled Cloud configuration, not the cost of re-implementing OAuth across every application. That gives you negotiating power with your current supplier and a clean off-ramp when the contract is up.

Beyond token handling

Handled Cloud runs the full session at a single edge node. Login, logout, refresh, and the JWT that reaches your origin are all handled in one place, so a new gateway or micro-frontend does not need its own identity integration.

Want to see how it fits together?

The architecture page shows how one deployment covers every origin: the control plane with us, the data plane in your Cloudflare account.

or see the architecture